GET /_plugins/_security_analytics/rules/categories
{
"rule_categories": [
{
"key": "ad_ldap",
"display_name": "AD/LDAP"
},
{
"key": "dns",
"display_name": "DNS logs"
},
{
"key": "network",
"display_name": "Network"
},
{
"key": "apache_access",
"display_name": "Apache access logs"
},
{
"key": "cloudtrail",
"display_name": "Cloud Trail logs"
},
{
"key": "s3",
"display_name": "S3 access logs"
},
{
"key": "windows",
"display_name": "Windows logs"
},
{
"key": "linux",
"display_name": "System logs"
}
]
}
Is your feature request related to a problem?
Currently FE has all rule categories hardcoded.
What solution would you like?
We need capability for FE to fetch current rule categories from backend. We can implement new API GetAllRuleCategories which will return all categories enabled in backend:
RESPONSE:
Response fields: